Detecting Uncooperative Ethernet Elements using Accurate Round-trip Time Measurements J.P. Delport∗

Abstract — Knowledge of a network’s entities and the physical connections between them (a network’s physical topology) can be useful in a variety of network scenarios and applications. Specifically, topology information can be used by administrators to detect unauthorised physical modifications to a network. Gathering accurate topology information manually can be a tedious and error-prone, if not impossible task. In this paper an active probing technique is used to obtain packet timing information from a set of experimental Ethernet LANs. Packets are sent from a probing host to a target node in a variety of network configurations and the total time from sending out the packet to receiving a reply is measured and stored. The stored timing data is then used to determine the influence of common Ethernet network elements on packet round-trip times. Real-Time Linux is used to obtain low-level and fine grained timing control over the probing host’s network card. I